Security Affairs

JUNE 21, 2022

Experts identified a spike in phishing content delivered via Azure Front Door (AFD), a cloud CDN service provided by Microsoft. USA) has identified a spike in phishing content delivered via Azure Front Door (AFD), a cloud CDN service provided by Microsoft. 1 – Example of Phishing Page Delivered by Azure Front Door (AFD).

Phishing 116

Phishing Accountability Hacking Scams 116

Security Affairs

FEBRUARY 10, 2023

A recently discovered threat actor, tracked as TA886 by security firm Proofpoint, is targeting organizations in the United States and Germany with new malware dubbed Screenshotter. The experts first spotted the attacks attributed to this threat actor in October 2022, they believe that the group is financially motivated.

Malware 78

Malware Phishing Spyware Cybercrime 78

Security Affairs

FEBRUARY 21, 2024

In the 2022 campaigns, threat actors used European Union reports on the conflict in Ukraine and Ukrainian government reports as lures. Upon opening the reports, the infection process starts leading to the deployment of malware on the victim’s system. The launcher also downloads the next-stage malware from a remote server.

Malware 106

Malware Phishing Government Passwords 106

Security Affairs

MARCH 22, 2023

The report covers incidents in aviation, maritime, railway, and road transport industries between January 2021 and October 2022. During the reporting period, ransomware was the most prominent threat against the sector in 2022. The researchers pointed out that the ransomware attacks doubled compared to the previous year.

Ransomware 79

Ransomware DDOS Cyber threats Phishing 79

Approachable Cyber Threats

DECEMBER 13, 2022

The 2022 update to our research on the perception of data breach causes that’s helped organizations re-evaluate how they are at risk for a data breach instead of what feels right. In their 2022 report, System Intrusion took the lead, accounting for 40% of all breach events. You may be asking “Why data from 2021 when it’s 2022?”

Data breaches 106

Data breaches Social Engineering Engineering Phishing 106

Security Affairs

MAY 21, 2024

Black Basta has been active since April 2022, like other ransomware operations, it implements a double-extortion attack model. In November 2022, Sentinel Labs researchers reported having found evidence that links the Black Basta ransomware gang to the financially motivated hacking group FIN7.

Hacking 122

Hacking Ransomware Phishing Malware 122

Security Affairs

FEBRUARY 17, 2022

Starting in January 2022, security researchers from Avanan observed attackers compromising Microsoft Teams accounts attach malicious executables to chat and infect participants in the conversation. “Starting in January 2022, Avanan observed how hackers are dropping malicious executable files in Teams conversations.

Malware 139

Malware Phishing Accountability Data breaches 139

Security Affairs

APRIL 9, 2024

Fortinet researchers observed a threat actor sending out a phishing email containing malicious Scalable Vector Graphics (SVG) files. The campaign is notable for its utilization of the BatCloak malware obfuscation engine and ScrubCrypt to distribute the malware through obfuscated batch scripts.

Engineering 88

Engineering Phishing Malware Hacking 88

Security Affairs

APRIL 23, 2022

Ukraine CERT-UA warns of phishing attacks on state organizations of Ukraine using the topic “Azovstal” and Cobalt Strike Beacon. The post Phishing attacks using the topic “Azovstal” targets entities in Ukraine appeared first on Security Affairs. To nominate, please visit:? Pierluigi Paganini.

Phishing 81

Phishing Cybercrime Ransomware Encryption 81

Security Affairs

MARCH 2, 2022

A spear-phishing campaign, tracked as Asylum Ambuscade, targets European government personnel aiding Ukrainian refugees. The phishing messages included a weaponized attachment designed to download a Lua-based malware dubbed SunSeed. net) that appears to belong to a compromised Ukranian armed service member.”

Phishing 75

Phishing Accountability Government Malware 75

Security Affairs

AUGUST 21, 2022

A new Grandoreiro banking malware campaign is targeting organizations in Mexico and Spain, Zscaler reported. Zscaler ThreatLabz researchers observed a Grandoreiro banking malware campaign targeting organizations in the Spanish-speaking nations of Mexico and Spain. ” reads the post published by Zscaler. Pierluigi Paganini.

Banking 85

Banking Malware Antivirus Phishing 85

Duo's Security Blog

MAY 10, 2023

With advanced language-based AI tools like ChatGPT growing increasingly accessible, the battle to prevent phishing attacks from impacting users is no longer answerable with just one security solution. Why is layered security essential against phishing? PCI DSS, HIPAA, etc.)

Phishing 54

Phishing DNS Authentication Risk 54

Security Affairs

MAY 12, 2024

Black Basta ransomware affiliates have breached over 500 organizations between April 2022 and May 2024, FBI and CISA reported. Black Basta ransomware-as-a-service (RaaS) has been active since April 2022, it impacted several businesses and critical infrastructure entities across North America, Europe, and Australia.

Ransomware 106

Ransomware Hacking Healthcare Retail 106

Security Affairs

APRIL 16, 2022

Threat actors are targeting Ukrainian government agencies with phishing attacks delivering the IcedID malware. The Ukrainian Computer Emergency Response Team (CERT-UA) uncovered new phishing campaigns aimed at infecting systems of Ukrainian government agencies with the IcedID malware. Pierluigi Paganini.

Malware 77

Malware Phishing Banking Government 77

Security Affairs

NOVEMBER 9, 2022

Experts noticed that the Amadey malware is being used to deploy LockBit 3.0 Researchers from AhnLab Security Emergency Response Center (ASEC) reported that the Amadey malware is being used to deploy LockBit 3.0 ” reads the report published by the security firm. SecurityAffairs – hacking, Amadey malware).

Malware 84

Malware Ransomware Cybercrime Phishing 84

Security Affairs

APRIL 20, 2023

North Korea-linked APT group Lazarus employed new Linux malware in attacks that are part of Operation Dream Job. North Korea-linked APT group Lazarus is behind a new campaign tracked as Operation DreamJob (aka DeathNote or NukeSped ) that employed Linux malware. “Interestingly, the file extension is not .pdf.

Malware 92

Malware Social Engineering Education Media 92

Security Affairs

MARCH 12, 2022

Threat actors are spreading the BazarLoader malware via website contact forms to evade detection, researchers warn. Researchers from cybersecurity firm Abnormal Security observed threat actors spreading the BazarLoader/BazarBackdoor malware via website contact forms. ” reads the analysis published by Abnormal Security.

Malware 82

Malware Phishing Ransomware Banking 82

eSecurity Planet

JUNE 7, 2022

They earned the highest score among providers named "Customer's Choice" in Gartner's 2022 "Voice of the Customer” Security Awareness Computer-Based Training report. Application security, information security, network security, disaster recovery, operational security, etc. Improved Data Security.

Cybersecurity 124

Cybersecurity Identity Theft Encryption Antivirus 124

Security Affairs

AUGUST 28, 2022

The Python Package Index (PyPI) warns of an ongoing phishing campaign to steal developer credentials and distribute malicious updates. The Python Package Index, PyPI, this week warned of an ongoing phishing campaign that aims to steal developer credentials and inject malicious updates to the packages in the repository.

Phishing 79

Phishing Hacking Accountability Cybercrime 79

SecureList

NOVEMBER 23, 2021

Reducing the life cycle of malware. To avoid detection, more and more cybercriminals are adopting the strategy of frequently upgrading malware in their chosen family. The evolution of modern MaaS platforms makes it much easier for malware operators globally to use this strategy. Actions of various attacker categories.

Spyware 109

Spyware Phishing Cybercrime Energy and Utilities 109

Security Affairs

NOVEMBER 7, 2022

The phishing-as-a-service (PhaaS) platform Robin Banks migrated its infrastructure to DDoS-Guard, a Russian bulletproof hosting service. The Robin Banks was first analyzed July 2022, it relies heavily on open-source code and off-the-shelf tooling. ” reads a report published by security firm IronNet.

Banking 86

Banking Phishing DDOS Authentication 86

SecureList

OCTOBER 18, 2023

In early September 2022, we discovered several new malware samples belonging to the MATA cluster. As we were collecting and analyzing the relevant telemetry data, we realized the campaign had been launched in mid-August 2022 and targeted over a dozen corporations in Eastern Europe from the oil and gas sector and defense industry.

Malware 105

Malware Phishing Internet Internet 105

Security Affairs

NOVEMBER 24, 2022

Researchers warn of an ongoing aggressive Qakbot malware campaign that leads to Black Basta ransomware infections in the US. Experts at the Cybereason Global SOC (GSOC) team have observed a surge in Qakbot infections as part of an ongoing aggressive Qakbot malware campaign that leads to Black Basta ransomware infections in the US.

Malware 81

Malware Ransomware DNS Phishing 81

Security Affairs

FEBRUARY 8, 2024

26 key cyber security stats for 2024 that every user should know, from rising cyber crime rates to the impact of AI technolog y. Phishing Attacks: Phishing is the top cyber attack, causing 90% of data breaches. Cyber Insurance: US cyber insurance premiums soared by 50% in 2022, reaching $7.2

Social Engineering 115

Social Engineering Cyber Attacks Cyber Insurance IoT 115

Security Affairs

MAY 3, 2024

The threat actors used the botnet harvest credentials, collect NTLMv2 digests, proxy network traffic, and host spear-phishing landing pages and custom tools. This second botnet exhibits greater discretion and improved operational security, as the associated malware operates exclusively in memory, leaving no malicious files on the disk.

Phishing 91

Phishing Cryptocurrency Internet Internet 91

Security Affairs

DECEMBER 2, 2022

Cuba ransomware gang received more than $60 million in ransom payments related to attacks against 100 entities worldwide as of August 2022. Dollars (USD) and received more than $60 million in ransom payments from over 100 victims worldwide as of August 2022, the US government states. ” reads the report. Pierluigi Paganini.

Ransomware 79

Ransomware Financial Services Manufacturing Healthcare 79

Security Affairs

DECEMBER 25, 2023

The threat actor UAC-0099 is exploiting a flaw in the WinRAR to deliver LONEPAGE malware in attacks against Ukraine. In some attacks, the APT group exploited a high-severity WinRAR flaw CVE-2023-38831 to deliver the LONEPAGE malware. The last-stage malware is the Visual Basic Script (VBS) malware LONEPAGE.

Malware 125

Malware Phishing Media Hacking 125

Security Affairs

JUNE 20, 2022

The developers behind the BRATA Android malware have implemented additional features to avoid detection. The operators behind the BRATA Android malware have implemented more features to make their attacks stealthy. “TAs are modifying their code in order to tailor their malware on specific banking institutions.

Malware 91

Malware Banking Antivirus Phishing 91

Security Affairs

JANUARY 18, 2024

Google warns that the Russia-linked threat actor COLDRIVER expands its targeting and is developing a custom malware. In the past, the group’s activity involved persistent phishing and credential theft campaigns leading to intrusions and data theft.

Phishing 89

Phishing Malware Encryption Accountability 89

SecureWorld News

FEBRUARY 23, 2023

The news was first reported by cybersecurity and malware research group vx-underground, which posted screenshots of data purportedly stolen from the company. Also worth noting that the Threat Actor(s) did attempt to phish other employees. Other employees did not fall for the phish.

Hacking 77

Hacking Phishing Data breaches Information Security 77

Security Affairs

NOVEMBER 4, 2022

The Europen Agency for cybersecurity ENISA releases its ENISA Threat Landscape 2022 (ETL) report , which is the annual analysis of the state of the cybersecurity threat landscape. This is the 10 th edition of the annual report and analyzes events that took place between July 2021 and July 2022. ENISA Threat Landscape Report 2022.

Cyber threats 113

Cyber threats Phishing Social Engineering Ransomware 113

SecureList

APRIL 24, 2023

It is worth noting that while we identified a few targets in other locations, all of them appear to be foreign diplomatic entities of the colored countries: Tomiris’s polyglot toolset Tomiris uses a wide variety of malware implants developed at a rapid pace and in all programming languages imaginable.

Malware 96

Malware DNS Government Software 96

Security Affairs

SEPTEMBER 21, 2022

Russia-linked APT group Sandworm has been observed impersonating telecommunication providers to target Ukrainian entities with malware. Russia-linked cyberespionage group Sandworm has been observed impersonating telecommunication providers to target Ukrainian entities with malware. ” reads the report published by Recorded Future.

Malware 77

Malware Telecommunications DNS Hacking 77

Approachable Cyber Threats

DECEMBER 13, 2022

The 2022 update to our research on the perception of data breach causes that’s helped organizations re-evaluate how they are at risk for a data breach instead of what feels right. In their 2022 report, System Intrusion took the lead, accounting for 40% of all breach events. You may be asking “Why data from 2021 when it’s 2022?”

Data breaches 52

Data breaches Social Engineering Engineering Phishing 52

Security Affairs

SEPTEMBER 26, 2022

A China-linked cyberespionage group, tracked as TA413 (aka LuckyCat) , is exploiting recently disclosed flaws in Sophos Firewall (CVE-2022-1040) and Microsoft Office ( CVE-2022-30190 ) to deploy a never-before-detected backdoor called LOWZERO in attacks aimed at Tibetan entities. in Microsoft Office in attacks in the wild.

Firewall 98

Firewall Phishing Malware Hacking 98

Security Affairs

MARCH 25, 2024

The threat actors sent out spam emails with attachments that eventually launched the StrelaStealer malware. The malware StrelaStealer is an email credential stealer that DCSO_CyTec first documented in November 2022. “StrelaStealer malware is an active email credential stealer that is always evolving.

Malware 94

Malware Encryption Manufacturing Phishing 94

Security Affairs

MAY 27, 2022

According to the experts, ERMAC is operated by threat actors behind the BlackRock mobile malware. The malware is available for rent on underground forums for $5000 per month since March 2022. Available for rent on underground forums for $5K/month since March 2022, ERMAC 2.0 A new #Android banker ERMAC 2.0 “ERMAC 2.0

Banking 140

Banking Malware Cybercrime Phishing 140